[oadp-1.4] OADP-8835: feat(bsl): concatenate all CA certificates from BSLs and include system defaults by redhat-chai-bot · Pull Request #2466 · openshift/oadp-operator

redhat-chai-bot · 2026-09-23T00:00:11Z

Cherry-pick of #1969 to oadp-1.4.

Changes

This cherry-picks the BSL CA certificate concatenation feature (OADP-6765/OADP-8835) from oadp-1.5 to oadp-1.4.

The automatic /cherry-pick oadp-1.4 had merge conflicts due to structural differences between the branches (oadp-1.4 uses controllers/ package with DPAReconciler, while oadp-1.5 uses internal/controller/ with DPAController). All conflicts were resolved by adapting the changes to oadp-1.4's codebase patterns.

Conflict Resolution Summary

controllers/velero.go: Added dpa.BackupImages() guard around CA cert processing, keeping oadp-1.4's method signature processCACertificatesForVelero(dpa, deploy, container)
controllers/bsl.go: Added validatePEMCertificate, BSL get-before-create pattern, Default field preservation, rewritten processCACertForBSLs with dedup/filtering/system CAs, getSystemCACertificates — all using DPAReconciler and dpa parameter pattern
controllers/bsl_test.go: Adapted new tests to use DPAReconciler, getFakeClientFromObjects, and newContextForTest(name)
controllers/velero_test.go: Extended reconciler setup for new CA processing, kept oadp-1.4 patterns
internal/controller/bsl.go: Removed (modify/delete conflict — changes applied to controllers/bsl.go instead)

Verification

go build ./... passes
All 59 relevant unit tests pass

(cherry pick of commit dcead30)

AI-generated. Review for accuracy.

@sseago requested via Chai Bot

…BSLs and include system defaults (openshift#1969) * feat(bsl): concatenate all CA certificates from BSLs and include system defaults Instead of using "first one wins" approach, now collects and concatenates all unique CA certificates from BackupStorageLocations. Also includes system default CA certificates when custom certificates are present. Changes: - Modified processCACertForBSLs() to collect all unique CA certificates - Added deduplication logic to avoid including same certificate multiple times - Added getSystemCACertificates() helper to retrieve system CA bundles - System defaults are only included when custom CAs are present - Updated tests to verify concatenation and deduplication behavior This allows for more flexible multi-cloud/multi-endpoint configurations where different BSLs may require different CA certificates. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * feat(bsl): ensure BSL reconciliation preserves default field to avoid conflicts with Velero management Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * feat(bsl): enhance CA certificate processing for multiple BSLs and add tests for validation Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * PEM verify + `podman run -v `pwd`:`pwd` -w `pwd` quay.io/konveyor/builder:ubi9-v1.23 sh -c "make lint-fix"` Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * refactor(nginx): reorganize deployment YAML structure to be compatible with e2e Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * feat(e2e): add CA certificate handling for default e2e BSL in multiple test files Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> --------- Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> Co-authored-by: Claude <noreply@anthropic.com> (cherry picked from commit dcead30)

redhat-chai-bot · 2026-09-23T00:00:14Z

Content scanning: findings recorded for this branch

Content scanning recorded the following findings for this branch.

Push	Tier / rule	Location	Git object
`9a0d51616944`	YARA: `private_key_pem`	`controllers/bsl_test.go`	`0774b2f0065c`

AI-generated. Review for accuracy. Maintained automatically; edits are overwritten.

openshift-merge-bot · 2026-09-23T00:00:14Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-09-23T00:00:16Z

@redhat-chai-bot: This pull request references OADP-8835 which is a valid jira issue.

Details

In response to this:

Cherry-pick of #1969 to oadp-1.4.

Changes

This cherry-picks the BSL CA certificate concatenation feature (OADP-6765/OADP-8835) from oadp-1.5 to oadp-1.4.

The automatic /cherry-pick oadp-1.4 had merge conflicts due to structural differences between the branches (oadp-1.4 uses controllers/ package with DPAReconciler, while oadp-1.5 uses internal/controller/ with DPAController). All conflicts were resolved by adapting the changes to oadp-1.4's codebase patterns.

Conflict Resolution Summary

controllers/velero.go: Added dpa.BackupImages() guard around CA cert processing, keeping oadp-1.4's method signature processCACertificatesForVelero(dpa, deploy, container)

controllers/bsl.go: Added validatePEMCertificate, BSL get-before-create pattern, Default field preservation, rewritten processCACertForBSLs with dedup/filtering/system CAs, getSystemCACertificates — all using DPAReconciler and dpa parameter pattern

controllers/bsl_test.go: Adapted new tests to use DPAReconciler, getFakeClientFromObjects, and newContextForTest(name)

controllers/velero_test.go: Extended reconciler setup for new CA processing, kept oadp-1.4 patterns

internal/controller/bsl.go: Removed (modify/delete conflict — changes applied to controllers/bsl.go instead)

Verification

go build ./... passes

All 59 relevant unit tests pass

(cherry pick of commit dcead30)

AI-generated. Review for accuracy.

@sseago requested via Chai Bot

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-09-23T00:00:19Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 84a2327b-949a-418b-b1d8-bffd04bd7df1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-09-23T00:02:12Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-chai-bot
Once this PR has been reviewed and has the lgtm label, please assign shawn-hurley for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Restore gofmt import ordering in controllers/bsl_test.go. The cherry-pick of openshift#1969 left github.com/stretchr/testify/assert out of gofmt import order, which makes `make test` fail at the fmt-isupdated gate (CI runs `make test submit-coverage`). Combined with the DPA/CloudStorage namespace alignment already on this branch, TestProcessCACertForBSLs now passes and `make test` is green (unit tests, fmt, api, and bundle checks all pass). Signed-off-by: Chai Bot <chai-bot@redhat.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

codecov-commenter · 2026-09-23T00:42:30Z

Codecov Report

❌ Patch coverage is 60.40609% with 78 lines in your changes missing coverage. Please review.
✅ Project coverage is 40.03%. Comparing base (c0b5d84) to head (8c7b600).

⚠️ Current head 8c7b600 differs from pull request most recent head 9a0d516

Please upload reports for the commit 9a0d516 to get more accurate results.

Files with missing lines	Patch %	Lines
controllers/bsl.go	61.13%	59 Missing and 16 partials ⚠️
controllers/velero.go	25.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           oadp-1.4    #2466      +/-   ##
============================================
+ Coverage     39.37%   40.03%   +0.65%     
============================================
  Files            30       30              
  Lines          5211     5378     +167     
============================================
+ Hits           2052     2153     +101     
- Misses         2959     3014      +55     
- Partials        200      211      +11

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

redhat-chai-bot · 2026-09-23T02:51:16Z

/retest-required

AI-generated. Review for accuracy.

sseago · 2026-09-23T13:09:25Z

/retest

kaovilai

@redhat-chai-bot check Restore the DPA controller owner reference on velero-ca-bundle. The original #1969 calls controllerutil.SetControllerReference, while #2466 does not. Without it, DPA deletion will not garbage-collect the ConfigMap. Add the owner reference inside the CreateOrPatch callback and test it.

redhat-chai-bot · 2026-09-23T15:25:14Z

@kaovilai Good catch — I'll add the controllerutil.SetControllerReference call inside the CreateOrPatch callback and add a test for it. Working on this now.

AI-generated. Review for accuracy.

redhat-chai-bot · 2026-09-23T17:53:18Z

/retest

AI-generated. Review for accuracy.

openshift-ci · 2026-09-23T20:34:00Z

@redhat-chai-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 23, 2026

openshift-ci Bot requested review from Joeavaikath and eemcmullan September 23, 2026 00:01

redhat-chai-bot and others added 3 commits September 23, 2026 00:12

fix: include missing bsl.go changes from original PR

71b3622

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: align DPA namespace with CloudStorage namespace in test

f7f0c7b

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sseago changed the title ~~[release-1.4] OADP-8835: feat(bsl): concatenate all CA certificates from BSLs and include system defaults~~ [oadp-1.4] OADP-8835: feat(bsl): concatenate all CA certificates from BSLs and include system defaults Sep 23, 2026

sseago requested review from kaovilai and a lite review from Copilot and removed request for Copilot September 23, 2026 00:51

Copilot started reviewing on behalf of sseago September 23, 2026 00:51 View session

kaovilai reviewed Sep 23, 2026

View reviewed changes

kaovilai mentioned this pull request Sep 23, 2026

Track BSL CA bundle rotation, cleanup, validation, and error handling gaps #2467

Open

9 tasks

OADP-8835: add DPA owner reference on velero-ca-bundle ConfigMap

9a0d516

Conversation

redhat-chai-bot commented Sep 23, 2026

Changes

Conflict Resolution Summary

Verification

Uh oh!

redhat-chai-bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Content scanning: findings recorded for this branch

Uh oh!

openshift-merge-bot Bot commented Sep 23, 2026

Uh oh!

openshift-ci-robot commented Sep 23, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Conflict Resolution Summary

Verification

Uh oh!

coderabbitai Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci Bot commented Sep 23, 2026

Uh oh!

codecov-commenter commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

redhat-chai-bot commented Sep 23, 2026

Uh oh!

sseago commented Sep 23, 2026

Uh oh!

kaovilai left a comment

Choose a reason for hiding this comment

Uh oh!

redhat-chai-bot commented Sep 23, 2026

Uh oh!

redhat-chai-bot commented Sep 23, 2026

Uh oh!

openshift-ci Bot commented Sep 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

redhat-chai-bot commented Sep 23, 2026 •

edited

Loading

openshift-ci-robot commented Sep 23, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Sep 23, 2026 •

edited

Loading

codecov-commenter commented Sep 23, 2026 •

edited

Loading